Skip to content

Commit 7220608

Browse files
robgaAzure Policy Bot
robga
and
Azure Policy Bot
authored
Built-in Policy Release 2490210e (#1509)
Co-authored-by: Azure Policy Bot <azgovpolicy@microsoft.com>
1 parent 4ed1332 commit 7220608

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+341
-227
lines changed

‎built-in-policies/policyDefinitions/App Service/WebApp_Slot_SshEnabled_Audit.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"properties": {
3+
"displayName": "App Service app slots should disable SSH",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Azure App Service allows you to open an SSH session to a container running in the service. This feature should be disabled to ensure that SSH is not inadvertently left open on App Service apps, reducing the risk of unauthorized access. Learn more at: https://aka.ms/app-service-ssh",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "App Service"
10+
},
11+
"version": "1.0.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "Enable or disable the execution of the policy"
18+
},
19+
"allowedValues": [
20+
"Audit",
21+
"Deny",
22+
"Disabled"
23+
],
24+
"defaultValue": "Audit"
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"allOf": [
30+
{
31+
"field": "type",
32+
"equals": "Microsoft.Web/sites/slots"
33+
},
34+
{
35+
"anyOf": [
36+
{
37+
"field": "Microsoft.Web/sites/slots/sshEnabled",
38+
"exists": "false"
39+
},
40+
{
41+
"field": "Microsoft.Web/sites/slots/sshEnabled",
42+
"notEquals": "false"
43+
}
44+
]
45+
}
46+
]
47+
},
48+
"then": {
49+
"effect": "[parameters('effect')]"
50+
}
51+
},
52+
"versions": [
53+
"1.0.0"
54+
]
55+
},
56+
"id": "/providers/Microsoft.Authorization/policyDefinitions/a88d589f-2b09-4b50-8998-9a4e71d7b746",
57+
"name": "a88d589f-2b09-4b50-8998-9a4e71d7b746"
58+
}

‎built-in-policies/policyDefinitions/App Service/WebApp_SshEnabled_Audit.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"properties": {
3+
"displayName": "App Service apps should disable SSH",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Azure App Service allows you to open an SSH session to a container running in the service. This feature should be disabled to ensure that SSH is not inadvertently left open on App Service apps, reducing the risk of unauthorized access. Learn more at: https://aka.ms/app-service-ssh",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "App Service"
10+
},
11+
"version": "1.0.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"metadata": {
16+
"displayName": "Effect",
17+
"description": "Enable or disable the execution of the policy"
18+
},
19+
"allowedValues": [
20+
"Audit",
21+
"Deny",
22+
"Disabled"
23+
],
24+
"defaultValue": "Audit"
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"allOf": [
30+
{
31+
"field": "type",
32+
"equals": "Microsoft.Web/sites"
33+
},
34+
{
35+
"anyOf": [
36+
{
37+
"field": "Microsoft.Web/sites/sshEnabled",
38+
"exists": "false"
39+
},
40+
{
41+
"field": "Microsoft.Web/sites/sshEnabled",
42+
"notEquals": "false"
43+
}
44+
]
45+
}
46+
]
47+
},
48+
"then": {
49+
"effect": "[parameters('effect')]"
50+
}
51+
},
52+
"versions": [
53+
"1.0.0"
54+
]
55+
},
56+
"id": "/providers/Microsoft.Authorization/policyDefinitions/25255ddf-ef4f-4283-975a-5590ad111bba",
57+
"name": "25255ddf-ef4f-4283-975a-5590ad111bba"
58+
}

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/CannotEditIndividualNodes.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Cannot Edit Individual Nodes",
3+
"displayName": "Cannot Edit Individual Nodes",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Cannot Edit Individual Nodes. Users should not edit individual nodes. Please edit node pools. Modifying individual nodes can lead to inconsistent settings, operational challenges, and potential security risks.",
77
"metadata": {
8-
"version": "1.2.0-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "1.2.1",
9+
"category": "Kubernetes"
1110
},
12-
"version": "1.2.0-preview",
11+
"version": "1.2.1",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -181,6 +180,7 @@
181180
}
182181
},
183182
"versions": [
183+
"1.2.1",
184184
"1.2.0-PREVIEW",
185185
"1.1.0-PREVIEW",
186186
"1.0.4-PREVIEW",

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/ContainerEnforcePreStopHook.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Kubernetes cluster container images must include the preStop hook",
3+
"displayName": "Kubernetes cluster container images must include the preStop hook",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Requires that container images include a preStop hook to gracefully terminate processes during pod shutdowns.",
77
"metadata": {
8-
"version": "1.1.0-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "1.1.1",
9+
"category": "Kubernetes"
1110
},
12-
"version": "1.1.0-preview",
11+
"version": "1.1.1",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -155,6 +154,7 @@
155154
}
156155
},
157156
"versions": [
157+
"1.1.1",
158158
"1.1.0-PREVIEW",
159159
"1.0.0-PREVIEW"
160160
]

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/ContainerRestrictedImagePulls.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Kubernetes cluster containers should only pull images when image pull secrets are present",
3+
"displayName": "Kubernetes cluster containers should only pull images when image pull secrets are present",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Restrict containers' image pulls to enforce the presence of ImagePullSecrets, ensuring secure and authorized access to images within a Kubernetes cluster",
77
"metadata": {
8-
"version": "1.1.0-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "1.1.1",
9+
"category": "Kubernetes"
1110
},
12-
"version": "1.1.0-preview",
11+
"version": "1.1.1",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -156,6 +155,7 @@
156155
}
157156
},
158157
"versions": [
158+
"1.1.1",
159159
"1.1.0-PREVIEW",
160160
"1.0.0-PREVIEW"
161161
]

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/ImagesDoNotUseLatest.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Kubernetes cluster container images should not include latest image tag",
3+
"displayName": "Kubernetes cluster container images should not include latest image tag",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Requires that container images do not use the latest tag in Kubernetes, it is a best practice to ensure reproducibility, prevent unintended updates, and facilitate easier debugging and rollbacks by using explicit and versioned container images.",
77
"metadata": {
8-
"version": "2.0.0-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "2.0.1",
9+
"category": "Kubernetes"
1110
},
12-
"version": "2.0.0-preview",
11+
"version": "2.0.1",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -152,6 +151,7 @@
152151
}
153152
},
154153
"versions": [
154+
"2.0.1",
155155
"2.0.0-PREVIEW",
156156
"1.1.0-PREVIEW",
157157
"1.0.0-PREVIEW"

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/MustHaveAntiAffinityRulesSet.json‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Must Have Anti Affinity Rules or Topology Spread Constraints Set",
3+
"displayName": "Must Have Anti Affinity Rules or Topology Spread Constraints Set",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "This policy ensures that pods are scheduled on different nodes within the cluster. By enforcing anti-affinity rules or pod topology spread constraints, availability is maintained even if one of the nodes becomes unavailable. Pods will continue to run on other nodes, enhancing resilience.",
77
"metadata": {
8-
"version": "1.1.1-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "1.1.2",
9+
"category": "Kubernetes"
1110
},
12-
"version": "1.1.1-preview",
11+
"version": "1.1.2",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -155,8 +154,8 @@
155154
}
156155
},
157156
"versions": [
157+
"1.1.2",
158158
"1.1.1-PREVIEW",
159-
"1.1.0-PREVIEW",
160159
"1.0.2-PREVIEW",
161160
"1.0.1-PREVIEW"
162161
]

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/MutateMaxUnavailablePods.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Sets maxUnavailable pods to 1 for PodDisruptionBudget resources",
3+
"displayName": "Sets maxUnavailable pods to 1 for PodDisruptionBudget resources",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Setting your max unavailable pod value to 1 ensures that your application or service is available during a disruption",
77
"metadata": {
8-
"version": "1.2.0-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "1.2.1",
9+
"category": "Kubernetes"
1110
},
12-
"version": "1.2.0-preview",
11+
"version": "1.2.1",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -68,6 +67,7 @@
6867
}
6968
},
7069
"versions": [
70+
"1.2.1",
7171
"1.2.0-PREVIEW",
7272
"1.1.0-PREVIEW",
7373
"1.0.0-PREVIEW"

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/MutateReadOnlyRootFilesystem.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Sets readOnlyRootFileSystem in the Pod spec to true if it is not set.",
3+
"displayName": "Sets readOnlyRootFileSystem in the Pod spec to true if it is not set.",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Setting readOnlyRootFileSystem to true increases security by preventing containers from writing into the root filesystem",
77
"metadata": {
8-
"version": "1.2.0-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "1.2.1",
9+
"category": "Kubernetes"
1110
},
12-
"version": "1.2.0-preview",
11+
"version": "1.2.1",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -68,6 +67,7 @@
6867
}
6968
},
7069
"versions": [
70+
"1.2.1",
7171
"1.2.0-PREVIEW",
7272
"1.1.0-PREVIEW",
7373
"1.0.0-PREVIEW"

‎built-in-policies/policyDefinitions/Azure Government/Kubernetes/MutateReadOnlyRootFilesystemInitContainers.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "[Preview]: Sets readOnlyRootFileSystem in the Pod spec in init containers to true if it is not set.",
3+
"displayName": "Sets readOnlyRootFileSystem in the Pod spec in init containers to true if it is not set.",
44
"policyType": "BuiltIn",
55
"mode": "Microsoft.Kubernetes.Data",
66
"description": "Setting readOnlyRootFileSystem to true increases security by preventing containers from writing into the root filesystem. This works only for linux containers.",
77
"metadata": {
8-
"version": "1.2.0-preview",
9-
"category": "Kubernetes",
10-
"preview": true
8+
"version": "1.2.1",
9+
"category": "Kubernetes"
1110
},
12-
"version": "1.2.0-preview",
11+
"version": "1.2.1",
1312
"parameters": {
1413
"source": {
1514
"type": "String",
@@ -68,6 +67,7 @@
6867
}
6968
},
7069
"versions": [
70+
"1.2.1",
7171
"1.2.0-PREVIEW",
7272
"1.1.0-PREVIEW",
7373
"1.0.0-PREVIEW"

0 commit comments

Comments
 (0)